From: Josh Poimboeuf <[email protected]> Enable CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL for both fedora and ARK. This prevents a lot of uninitialized stack variable exploits, with a minimal impact on performance.
This feature is incompatible with CONFIG_KASAN, so it can't be enabled on debug kernels. Also, it's mutually exclusive with CONFIG_INIT_STACK_NONE=y. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1856176 Signed-off-by: Josh Poimboeuf <[email protected]> --- .../configs/common/debug/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL | 1 + redhat/configs/common/debug/CONFIG_INIT_STACK_NONE | 1 + .../common/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL | 2 +- redhat/configs/common/generic/CONFIG_INIT_STACK_NONE | 2 +- 4 files changed, 4 insertions(+), 2 deletions(-) create mode 100644 redhat/configs/common/debug/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL create mode 100644 redhat/configs/common/debug/CONFIG_INIT_STACK_NONE diff --git a/redhat/configs/common/debug/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL b/redhat/configs/common/debug/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL new file mode 100644 index 000000000000..83bd543915b6 --- /dev/null +++ b/redhat/configs/common/debug/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL @@ -0,0 +1 @@ +# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL is not set diff --git a/redhat/configs/common/debug/CONFIG_INIT_STACK_NONE b/redhat/configs/common/debug/CONFIG_INIT_STACK_NONE new file mode 100644 index 000000000000..16e74023a918 --- /dev/null +++ b/redhat/configs/common/debug/CONFIG_INIT_STACK_NONE @@ -0,0 +1 @@ +CONFIG_INIT_STACK_NONE=y diff --git a/redhat/configs/common/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL b/redhat/configs/common/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL index 83bd543915b6..1713b5628e90 100644 --- a/redhat/configs/common/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL +++ b/redhat/configs/common/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL @@ -1 +1 @@ -# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL is not set +CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y diff --git a/redhat/configs/common/generic/CONFIG_INIT_STACK_NONE b/redhat/configs/common/generic/CONFIG_INIT_STACK_NONE index 16e74023a918..37f7832f62d2 100644 --- a/redhat/configs/common/generic/CONFIG_INIT_STACK_NONE +++ b/redhat/configs/common/generic/CONFIG_INIT_STACK_NONE @@ -1 +1 @@ -CONFIG_INIT_STACK_NONE=y +# CONFIG_INIT_STACK_NONE is not set -- GitLab _______________________________________________ kernel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
